Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 13:08

General

  • Target

    0644ffe8b0035e3fbe98057e9800e85d_JaffaCakes118.exe

  • Size

    439KB

  • MD5

    0644ffe8b0035e3fbe98057e9800e85d

  • SHA1

    3ee09fac1dbb768c1fc1c8a75e67256a851b210a

  • SHA256

    b213d9d8de44806565f51c6dcc0eca2468db564f19fc8651f505a32476ba8f31

  • SHA512

    cc891aa8a29bf6cc680bf523d847f8ab40a3fc8c9a2213eb0721bfdbd58f694bd7f529b3c05d43539e0afe3e79bdf86fc281d0eaa71a81ff4712cfbe031ad408

  • SSDEEP

    12288:cYnMa876yH8pllF6kNN4kWumNtTirdt9+T:cYMaeilF137GTEdvq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0644ffe8b0035e3fbe98057e9800e85d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0644ffe8b0035e3fbe98057e9800e85d_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 704
      2⤵
      • Program crash
      PID:4192
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
      2⤵
        PID:2652
    • C:\Windows\windex.exe
      C:\Windows\windex.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:1136
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 792 -ip 792
        1⤵
          PID:3056
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3860,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
          1⤵
            PID:4024

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\UNINSTAL.BAT

            Filesize

            214B

            MD5

            835e6160d55e1f8e4ac5928d54d29eef

            SHA1

            e8b97c3d4c27da184ed670b57ec0d6f5361445b9

            SHA256

            2dd29f40bafec2352611e4af2c582e2e60afe613dacdbc3153bfa6021de0e437

            SHA512

            a21be038e0c156af2d3e0b0e7e78641b6b6eaf8bdbfafd7e064818bfe7b41b3db9fe9036ecc1f1e6ce31de876c1e6166ae78db1991ca3b4ee8baf8ac9fed4d00

          • C:\Windows\windex.exe

            Filesize

            439KB

            MD5

            0644ffe8b0035e3fbe98057e9800e85d

            SHA1

            3ee09fac1dbb768c1fc1c8a75e67256a851b210a

            SHA256

            b213d9d8de44806565f51c6dcc0eca2468db564f19fc8651f505a32476ba8f31

            SHA512

            cc891aa8a29bf6cc680bf523d847f8ab40a3fc8c9a2213eb0721bfdbd58f694bd7f529b3c05d43539e0afe3e79bdf86fc281d0eaa71a81ff4712cfbe031ad408

          • memory/792-0-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

          • memory/792-1-0x00000000022E0000-0x0000000002323000-memory.dmp

            Filesize

            268KB

          • memory/792-2-0x0000000002350000-0x0000000002351000-memory.dmp

            Filesize

            4KB

          • memory/792-6-0x00000000023B0000-0x00000000023B3000-memory.dmp

            Filesize

            12KB

          • memory/792-4-0x0000000000970000-0x0000000000971000-memory.dmp

            Filesize

            4KB

          • memory/792-5-0x0000000002370000-0x0000000002371000-memory.dmp

            Filesize

            4KB

          • memory/792-3-0x0000000000980000-0x0000000000981000-memory.dmp

            Filesize

            4KB

          • memory/792-7-0x00000000023A0000-0x00000000023A1000-memory.dmp

            Filesize

            4KB

          • memory/792-55-0x0000000002A30000-0x0000000002A31000-memory.dmp

            Filesize

            4KB

          • memory/792-56-0x0000000002A40000-0x0000000002A41000-memory.dmp

            Filesize

            4KB

          • memory/792-54-0x00000000029C0000-0x00000000029C1000-memory.dmp

            Filesize

            4KB

          • memory/792-53-0x0000000002A10000-0x0000000002A11000-memory.dmp

            Filesize

            4KB

          • memory/792-52-0x0000000002A20000-0x0000000002A21000-memory.dmp

            Filesize

            4KB

          • memory/792-51-0x00000000029F0000-0x00000000029F1000-memory.dmp

            Filesize

            4KB

          • memory/792-50-0x0000000002A00000-0x0000000002A01000-memory.dmp

            Filesize

            4KB

          • memory/792-49-0x00000000029D0000-0x00000000029D1000-memory.dmp

            Filesize

            4KB

          • memory/792-48-0x00000000029E0000-0x00000000029E1000-memory.dmp

            Filesize

            4KB

          • memory/792-47-0x00000000029B0000-0x00000000029B1000-memory.dmp

            Filesize

            4KB

          • memory/792-46-0x0000000002970000-0x0000000002971000-memory.dmp

            Filesize

            4KB

          • memory/792-45-0x0000000002980000-0x0000000002981000-memory.dmp

            Filesize

            4KB

          • memory/792-44-0x0000000002990000-0x0000000002991000-memory.dmp

            Filesize

            4KB

          • memory/792-43-0x0000000002950000-0x0000000002951000-memory.dmp

            Filesize

            4KB

          • memory/792-42-0x0000000002960000-0x0000000002961000-memory.dmp

            Filesize

            4KB

          • memory/792-41-0x0000000002800000-0x0000000002801000-memory.dmp

            Filesize

            4KB

          • memory/792-40-0x0000000002810000-0x0000000002811000-memory.dmp

            Filesize

            4KB

          • memory/792-58-0x0000000002A50000-0x0000000002A51000-memory.dmp

            Filesize

            4KB

          • memory/792-57-0x0000000002A60000-0x0000000002A61000-memory.dmp

            Filesize

            4KB

          • memory/792-39-0x00000000027E0000-0x00000000027E1000-memory.dmp

            Filesize

            4KB

          • memory/792-38-0x00000000027F0000-0x00000000027F1000-memory.dmp

            Filesize

            4KB

          • memory/792-37-0x00000000027C0000-0x00000000027C1000-memory.dmp

            Filesize

            4KB

          • memory/792-36-0x00000000027D0000-0x00000000027D1000-memory.dmp

            Filesize

            4KB

          • memory/792-35-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/792-34-0x00000000027A0000-0x00000000027A1000-memory.dmp

            Filesize

            4KB

          • memory/792-33-0x0000000002770000-0x0000000002771000-memory.dmp

            Filesize

            4KB

          • memory/792-32-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/792-31-0x0000000002750000-0x0000000002751000-memory.dmp

            Filesize

            4KB

          • memory/792-30-0x0000000002760000-0x0000000002761000-memory.dmp

            Filesize

            4KB

          • memory/792-29-0x0000000002620000-0x0000000002621000-memory.dmp

            Filesize

            4KB

          • memory/792-28-0x0000000002630000-0x0000000002631000-memory.dmp

            Filesize

            4KB

          • memory/792-27-0x0000000002600000-0x0000000002601000-memory.dmp

            Filesize

            4KB

          • memory/792-26-0x0000000002610000-0x0000000002611000-memory.dmp

            Filesize

            4KB

          • memory/792-25-0x00000000025E0000-0x00000000025E1000-memory.dmp

            Filesize

            4KB

          • memory/792-24-0x00000000025F0000-0x00000000025F1000-memory.dmp

            Filesize

            4KB

          • memory/792-23-0x00000000025C0000-0x00000000025C1000-memory.dmp

            Filesize

            4KB

          • memory/792-22-0x00000000025D0000-0x00000000025D1000-memory.dmp

            Filesize

            4KB

          • memory/792-21-0x00000000025A0000-0x00000000025A1000-memory.dmp

            Filesize

            4KB

          • memory/792-20-0x00000000025B0000-0x00000000025B1000-memory.dmp

            Filesize

            4KB

          • memory/792-19-0x0000000002580000-0x0000000002581000-memory.dmp

            Filesize

            4KB

          • memory/792-18-0x0000000002590000-0x0000000002591000-memory.dmp

            Filesize

            4KB

          • memory/792-17-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/792-16-0x0000000002570000-0x0000000002571000-memory.dmp

            Filesize

            4KB

          • memory/792-15-0x0000000002430000-0x0000000002431000-memory.dmp

            Filesize

            4KB

          • memory/792-14-0x0000000002550000-0x0000000002551000-memory.dmp

            Filesize

            4KB

          • memory/792-13-0x0000000002410000-0x0000000002411000-memory.dmp

            Filesize

            4KB

          • memory/792-12-0x0000000002420000-0x0000000002421000-memory.dmp

            Filesize

            4KB

          • memory/792-11-0x00000000023D0000-0x00000000023D1000-memory.dmp

            Filesize

            4KB

          • memory/792-10-0x0000000002390000-0x0000000002391000-memory.dmp

            Filesize

            4KB

          • memory/792-9-0x0000000002380000-0x0000000002381000-memory.dmp

            Filesize

            4KB

          • memory/792-8-0x00000000023C0000-0x00000000023C1000-memory.dmp

            Filesize

            4KB

          • memory/792-62-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

            Filesize

            4KB

          • memory/792-84-0x0000000002F10000-0x0000000002F11000-memory.dmp

            Filesize

            4KB

          • memory/792-83-0x0000000002F20000-0x0000000002F21000-memory.dmp

            Filesize

            4KB

          • memory/792-82-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

            Filesize

            4KB

          • memory/792-81-0x0000000002F00000-0x0000000002F01000-memory.dmp

            Filesize

            4KB

          • memory/792-80-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

            Filesize

            4KB

          • memory/792-79-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

            Filesize

            4KB

          • memory/792-78-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

            Filesize

            4KB

          • memory/792-77-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

            Filesize

            4KB

          • memory/792-76-0x0000000002E90000-0x0000000002E91000-memory.dmp

            Filesize

            4KB

          • memory/792-75-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

            Filesize

            4KB

          • memory/792-74-0x0000000002E70000-0x0000000002E71000-memory.dmp

            Filesize

            4KB

          • memory/792-73-0x0000000002E80000-0x0000000002E81000-memory.dmp

            Filesize

            4KB

          • memory/792-72-0x0000000002E50000-0x0000000002E51000-memory.dmp

            Filesize

            4KB

          • memory/792-71-0x0000000002E60000-0x0000000002E61000-memory.dmp

            Filesize

            4KB

          • memory/792-70-0x0000000002E30000-0x0000000002E31000-memory.dmp

            Filesize

            4KB

          • memory/792-69-0x0000000002E40000-0x0000000002E41000-memory.dmp

            Filesize

            4KB

          • memory/792-68-0x0000000002E10000-0x0000000002E11000-memory.dmp

            Filesize

            4KB

          • memory/792-67-0x0000000002E20000-0x0000000002E21000-memory.dmp

            Filesize

            4KB

          • memory/792-66-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

            Filesize

            4KB

          • memory/792-65-0x0000000002E00000-0x0000000002E01000-memory.dmp

            Filesize

            4KB

          • memory/792-64-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

            Filesize

            4KB

          • memory/792-63-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

            Filesize

            4KB

          • memory/792-61-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

            Filesize

            4KB

          • memory/792-86-0x0000000002F30000-0x0000000002F31000-memory.dmp

            Filesize

            4KB

          • memory/792-85-0x0000000002F40000-0x0000000002F41000-memory.dmp

            Filesize

            4KB

          • memory/792-89-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

          • memory/792-92-0x00000000022E0000-0x0000000002323000-memory.dmp

            Filesize

            268KB

          • memory/792-97-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

          • memory/792-96-0x00000000022E0000-0x0000000002323000-memory.dmp

            Filesize

            268KB

          • memory/3816-90-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

          • memory/3816-91-0x00000000006D0000-0x0000000000713000-memory.dmp

            Filesize

            268KB

          • memory/3816-99-0x0000000000400000-0x00000000004E9000-memory.dmp

            Filesize

            932KB

          • memory/3816-101-0x00000000006D0000-0x0000000000713000-memory.dmp

            Filesize

            268KB